The tactics basically amount to guessing:
- Standard directory testing: This guesses typical webpage files, like
/manager/login.jsp and the like.
- Dictionary Attacks": This guesses dictionary words, like "employee".
There are many tools that do this, like Burp Suite and Dirbuster.
The other technique that I like to use for finding hidden pages is searching Google. Simply putting in
site:*.example.com will return every single page on example.com that Google knows about. So, if Google-Bot has stumbled upon your page, I'll know about it too!
There's also the chance that someone will just guess it. It's not that hard. Now, a page like
example.com/lsjglkjlktjwlkfjsldkjfijflkwjflksdjflkdsjflkdsjf would be quite hard to find :)
Takeaway: if you don't want someone to see it, put an authentication challenge on it.